CVE-2023-48052
HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
- Record
CVE-2023-48052- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295, CWE-599
- Updated
- 2026-11-02
CVE List
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
- Record
CVE-2023-48052- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-599
- Updated
- 2026-11-02
EUVDEUVD-2023-0095
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
- Record
EUVD-2023-0095- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8r96-8889-qg2x
HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
- Record
GHSA-8r96-8889-qg2x- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295, CWE-599
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-48052
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
- Record
ALPINE-CVE-2023-48052- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
OSV
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
- Record
CVE-2023-48052- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2023-48052
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
- Record
DEBIAN-CVE-2023-48052- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-8r96-8889-qg2x
HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
- Record
GHSA-8r96-8889-qg2x- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295, CWE-599
- Updated
- 2026-11-02
OSVOESA-2025-2356
python-httpie security update
HTTPie (pronounced aitch-tee-tee-pie) is a command-line HTTP client. Its goal is to make CLI interaction with web services as human-friendly as possible. HTTPie is designed for testing, debugging, and generally interacting with APIs & HTTP servers. The http & https commands allow for creating and sending arbitrary HTTP requests. They use simple and natural syntax and provide formatted and colorized output.
Security Fix(es):
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.(CVE-2023-48052)
- Record
OESA-2025-2356- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2025-2357
python-httpie security update
HTTPie (pronounced aitch-tee-tee-pie) is a command-line HTTP client. Its goal is to make CLI interaction with web services as human-friendly as possible. HTTPie is designed for testing, debugging, and generally interacting with APIs & HTTP servers. The http & https commands allow for creating and sending arbitrary HTTP requests. They use simple and natural syntax and provide formatted and colorized output.
Security Fix(es):
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.(CVE-2023-48052)
- Record
OESA-2025-2357- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2025-2358
python-httpie security update
HTTPie (pronounced aitch-tee-tee-pie) is a command-line HTTP client. Its goal is to make CLI interaction with web services as human-friendly as possible. HTTPie is designed for testing, debugging, and generally interacting with APIs & HTTP servers. The http & https commands allow for creating and sending arbitrary HTTP requests. They use simple and natural syntax and provide formatted and colorized output.
Security Fix(es):
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.(CVE-2023-48052)
- Record
OESA-2025-2358- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVPYSEC-2023-242
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
- Record
PYSEC-2023-242- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-48052
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
- Record
UBUNTU-CVE-2023-48052- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
httpiePyPI |
through 3.2.2 | 3.2.3 |
httpieAlpine:v3.20 |
before 3.2.3-r0 | 3.2.3-r0 |
httpieAlpine:v3.21 |
before 3.2.3-r0 | 3.2.3-r0 |
httpieAlpine:v3.22 |
before 3.2.3-r0 | 3.2.3-r0 |
httpieAlpine:v3.23 |
before 3.2.3-r0 | 3.2.3-r0 |
httpieAlpine:v3.24 |
before 3.2.3-r0 | 3.2.3-r0 |
httpieDebian:12 |
All versions, plus listed versions 3.2.1-13.2.1-23.2.2-13.2.4-13.2.4-23.2.4-33.2.4-4 |
None known |
httpieDebian:13 |
All versions, plus listed versions 3.2.4-33.2.4-4 |
None known |
httpieDebian:14 |
All versions, plus listed versions 3.2.4-33.2.4-4 |
None known |
httpiePyPI |
before 3.2.3, plus listed versions 0.10.1.10.1.20.1.30.1.4 Show 45 moreShow less0.1.50.1.60.2.00.2.10.2.20.2.30.2.40.2.4dev0.2.50.2.60.2.70.3.00.3.10.4.00.4.10.5.00.5.10.6.00.7.00.7.20.8.00.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.21.0.32.0.02.1.02.2.02.3.02.4.02.5.02.6.03.0.03.0.13.0.23.1.0 |
3.2.3 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-httpieopenEuler:24.03-LTS |
before 3.2.4-1.oe2403 | 3.2.4-1.oe2403 |
python-httpieopenEuler:24.03-LTS-SP1 |
before 3.2.4-1.oe2403sp1 | 3.2.4-1.oe2403sp1 |
python-httpieopenEuler:24.03-LTS-SP2 |
before 3.2.4-1.oe2403sp2 | 3.2.4-1.oe2403sp2 |
httpiePyPI |
All versions, plus listed versions 0.10.1.10.1.20.1.30.1.4 Show 45 moreShow less0.1.50.1.60.2.00.2.10.2.20.2.30.2.40.2.4dev0.2.50.2.60.2.70.3.00.3.10.4.00.4.10.5.00.5.10.6.00.7.00.7.20.8.00.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.21.0.32.0.02.1.02.2.02.3.02.4.02.5.02.6.03.0.03.0.13.0.23.1.0 |
None known |
httpieUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.3.1-10.7.1-0.10.8.0-10.8.0-1+deb8u1build0.14.04.1~esm1 |
None known |
httpieUbuntu:16.04:LTS |
All versions, plus listed versions 0.9.2-0.10.9.2-1 |
None known |
httpieUbuntu:18.04:LTS |
All versions, plus listed versions 0.9.8-2 |
None known |
httpieUbuntu:20.04:LTS |
All versions, plus listed versions 0.9.8-21.0.3-2 |
None known |
httpieUbuntu:22.04:LTS |
All versions, plus listed versions 2.4.0-12.6.0-1 |
None known |
httpieUbuntu:24.04:LTS |
All versions, plus listed versions 3.2.1-13.2.1-23.2.2-1 |
None known |
httpieUbuntu:25.10 |
All versions, plus listed versions 3.2.4-3 |
None known |
httpieUbuntu:26.10 |
All versions, plus listed versions 3.2.4-4 |
None known |
httpieUbuntu:26.04:LTS |
All versions, plus listed versions 3.2.4-33.2.4-4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-48052 is a high vulnerability (CVSS 7.4) in Httpie, published November 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in httpie 3.2.3.
References
gxx777.github.io/HTTPie_3.2.2_Cryptographic_API_Misuse_Vulnerability.md
nvd.nist.gov/vuln/detail/CVE-2023-48052
github.com/httpie/cli/blob/master/httpie/client.py
Show 11 moreShow less
security.alpinelinux.org/vuln/CVE-2023-48052
security-tracker.debian.org/tracker/CVE-2023-48052
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-2356
ubuntu.com/security/CVE-2023-48052
cve.org/CVERecord?id=CVE-2023-48052
Left out here: 8 versions. The JSON record has them.